mcp-handler

Summary Expired tokens that also lack a required scope now correctly return instead of Moves the check above the check in so expiry is always evaluated first, per RFC 6750 §3.1 Adds regression tests for expiry-vs-scope ordering, live+unscoped, live+scoped, expired-no-scopes-required, and missing-auth paths Fixes #181 Why it matters tells an MCP client its token is no longer valid — the client should refresh or re-authenticate. tells the client it has the wrong permissions — the client will not refresh and may surface a misleading "insufficient permissions" error. When both conditions are true, RFC 6750 requires the expiry to win. Test plan [x] New test: expired + missing scope → 401 (was 403 before fix) [x] New test: live + missing scope → 403 (unchanged) [x] New test: live + matching scope → 200 (unchanged) [x] New test: expired + no required scopes → 401 (unchanged) [x] New test: no auth + required → 401 (unchanged) [x] Full suite passes 29/29 ()

Bug When is configured with , an expired token that also lacks a required scope receives instead of . Per RFC 6750 §3.1, an expired token is regardless of what other checks fail. The distinction matters because: tells the client its token is no longer valid → the client should refresh or re-authenticate tells the client it has the wrong permissions → the client will not attempt a refresh and may surface a misleading "insufficient permissions" error to the user Reproduction Cause In , the scope check runs before the expiry check. An expired-and-unscoped token hits the scope gate first and never reaches the expiry gate. Fix Move the expiry check above the scope check so that expired tokens are always rejected as (401) before scopes are evaluated.

Summary Follow-up to #176 after exercising the SDK v2 upgrade at raw HTTP, client, framework, CLI, and published-package boundaries. reject unexpected browser Origins and add an explicit allowedOriginHostnames list preserve Allow: POST on stateless 405 responses prevent synchronous and asynchronous onEvent failures from breaking requests or becoming unhandled rejections verify SDK 1.26 clients, SDK 2 legacy mode, and pinned 2026-07-28 mode against the same handler verify auth policies and concurrent auth isolation make the CLI support src/app, --no-install, and safe refusal to overwrite existing routes test the packed artifact, correct its CommonJS type declaration target, and ship the docs linked from the npm README Defects found by the new tests 1. Cross-origin browser requests were accepted instead of returning 403. 2. Stateless GET and DELETE responses returned 405 without Allow: POST. 3. A throwing onEvent callback failed the MCP request; an async rejection became unhandled. 4. The CLI overwrote an existing route and could not be integration-tested without installing dependencies. 5. The published CommonJS types condition referenced the nonexistent dist/index.d.cjs file. 6. Documentation linked from the npm README was omitted from the tarball. Validation pnpm test: 44 tests across 6 files pnpm exec tsc --noEmit --noUnusedLocals --noUnusedParameters git diff --check linked package in mcp-for-next.js: type check and production build pass MCP Inspector CLI against the linked Next.js app: tools/list valid tools/call with structured output invalid tools/call returning isError tools/call on a dynamic custom mount path Release Includes a patch changeset for mcp-handler 2.0.1.